Service Enumeration via Web Shell Command

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•3

This rule detects attempts to enumerate services on a system using the 'sc query' command, typically executed via a web shell. The detection is based on the presence of 'sc query' within the HTTP URI, indicating a command injection attempt through a web application.